[syzbot] [bcachefs?] kernel BUG in bch2_btree_path_level_init (4)

[syzbot] [bcachefs?] kernel BUG in bch2_btree_path_level_init (4)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    d69eb204c255 Merge tag 'net-6.17-rc5' of git://git.kernel...
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16d01962580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=bd9738e00c1bbfb4
dashboard link: https://syzkaller.appspot.com/bug?extid=55c84106264e92ea9ada
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1788c962580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=12b0887c580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/efa41ea44c52/disk-d69eb204.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/d9ae66f326a4/vmlinux-d69eb204.xz
kernel image: https://storage.googleapis.com/syzbot-assets/967c2253578b/bzImage-d69eb204.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/9e7c59fc7ab3/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+55c84106264e92ea9ada@syzkaller.appspotmail.com

  running recovery passes: check_allocations,check_extents_to_backpointers,check_inodes
bcachefs (loop0): invalid bkey in btree_node btree=inodes level=0: u64s 18 type inode_v3 0:4102:U32_MAX len 0 ver 0: (unpack error)
  invalid variable length fields, deleting
bcachefs (loop0): accounting_read... done
bcachefs (loop0): alloc_read... done
bcachefs (loop0): alloc_read... done
bcachefs (loop0): snapshots_read... done
bcachefs (loop0): check_allocations...
------------[ cut here ]------------
kernel BUG at fs/bcachefs/btree_iter.c:633!
Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
CPU: 0 UID: 0 PID: 6000 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:bch2_btree_path_level_init+0xa01/0xa20 fs/bcachefs/btree_iter.c:633
Code: fd 90 0f 0b e8 90 05 a2 fd 90 0f 0b e8 88 05 a2 fd 90 0f 0b e8 80 05 a2 fd 90 0f 0b e8 78 05 a2 fd 90 0f 0b e8 70 05 a2 fd 90 <0f> 0b e8 68 05 a2 fd 90 0f 0b e8 60 05 a2 fd 90 0f 0b 66 66 66 66
RSP: 0018:ffffc90003f8e4a0 EFLAGS: 00010293
RAX: ffffffff841c59a0 RBX: ffff88803d33c2d8 RCX: ffff888030d73b80
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: dffffc0000000000 R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffed1007c6c817 R12: 0000000000000052
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS:  000055557a974500(0000) GS:ffff8881268c1000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fff395c5f24 CR3: 0000000027dc0000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 btree_path_down fs/bcachefs/btree_iter.c:994 [inline]
 bch2_btree_path_traverse_one+0x1367/0x21d0 fs/bcachefs/btree_iter.c:1202
 bch2_btree_path_traverse fs/bcachefs/btree_iter.h:250 [inline]
 __bch2_btree_iter_peek fs/bcachefs/btree_iter.c:2267 [inline]
 bch2_btree_iter_peek_max+0x9e8/0x58f0 fs/bcachefs/btree_iter.c:2384
 bch2_btree_iter_peek_max_type fs/bcachefs/btree_iter.h:743 [inline]
 bch2_gc_btree fs/bcachefs/btree_gc.c:729 [inline]
 bch2_gc_btrees fs/bcachefs/btree_gc.c:792 [inline]
 bch2_check_allocations+0x120d/0x57b0 fs/bcachefs/btree_gc.c:1094
 bch2_run_recovery_pass fs/bcachefs/recovery_passes.c:484 [inline]
 __bch2_run_recovery_passes+0x3bd/0x1060 fs/bcachefs/recovery_passes.c:539
 bch2_run_recovery_passes+0x184/0x210 fs/bcachefs/recovery_passes.c:610
 bch2_fs_recovery+0x2690/0x3a50 fs/bcachefs/recovery.c:1016
 bch2_fs_start+0xaaf/0xda0 fs/bcachefs/super.c:1213
 bch2_fs_get_tree+0xb39/0x1520 fs/bcachefs/fs.c:2488
 vfs_get_tree+0x8f/0x2b0 fs/super.c:1815
 do_new_mount+0x2a2/0x9e0 fs/namespace.c:3808
 do_mount fs/namespace.c:4136 [inline]
 __do_sys_mount fs/namespace.c:4347 [inline]
 __se_sys_mount+0x317/0x410 fs/namespace.c:4324
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fcb57f3038a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc365dc0a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007ffc365dc130 RCX: 00007fcb57f3038a
RDX: 0000200000000040 RSI: 0000200000004940 RDI: 00007ffc365dc0f0
RBP: 0000200000000040 R08: 00007ffc365dc130 R09: 0000000000004000
R10: 0000000000004000 R11: 0000000000000246 R12: 0000200000004940
R13: 00007ffc365dc0f0 R14: 00000000000049ae R15: 0000200000000180
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:bch2_btree_path_level_init+0xa01/0xa20 fs/bcachefs/btree_iter.c:633
Code: fd 90 0f 0b e8 90 05 a2 fd 90 0f 0b e8 88 05 a2 fd 90 0f 0b e8 80 05 a2 fd 90 0f 0b e8 78 05 a2 fd 90 0f 0b e8 70 05 a2 fd 90 <0f> 0b e8 68 05 a2 fd 90 0f 0b e8 60 05 a2 fd 90 0f 0b 66 66 66 66
RSP: 0018:ffffc90003f8e4a0 EFLAGS: 00010293
RAX: ffffffff841c59a0 RBX: ffff88803d33c2d8 RCX: ffff888030d73b80
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: dffffc0000000000 R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffed1007c6c817 R12: 0000000000000052
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS:  000055557a974500(0000) GS:ffff8881268c1000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fff395c5f24 CR3: 0000000027dc0000 CR4: 00000000003526f0


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Re: [syzbot] [bcachefs?] kernel BUG in bch2_btree_path_level_init (4)

[syzbot]

syzbot has bisected this issue to:

commit f11ca2ab18e369a662c2f60d53b8bea46c54e312
Author: Kent Overstreet <kent.overstreet@linux.dev>
Date:   Thu Nov 28 03:29:54 2024 +0000

    bcachefs: Guard against backpointers to unknown btrees

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=1663c962580000
start commit:   d69eb204c255 Merge tag 'net-6.17-rc5' of git://git.kernel...
git tree:       upstream
final oops:     https://syzkaller.appspot.com/x/report.txt?x=1563c962580000
console output: https://syzkaller.appspot.com/x/log.txt?x=1163c962580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=bd9738e00c1bbfb4
dashboard link: https://syzkaller.appspot.com/bug?extid=55c84106264e92ea9ada
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1788c962580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=12b0887c580000

Reported-by: syzbot+55c84106264e92ea9ada@syzkaller.appspotmail.com
Fixes: f11ca2ab18e3 ("bcachefs: Guard against backpointers to unknown btrees")

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

[PATCH] bcachefs:fix use-after-free in __bch2_bkey_fsck_err

[ssrane_b23]

From: Shaurya Rane <ssrane_b23@ee.vjti.ac.in>

When mounting a corrupted bcachefs filesystem, KASAN detects a
use-after-free in the error reporting path. This occurs due to a race
between error reporting and key deletion during fsck.

The sequence of events:

1. extent_ptr_validate() detects an invalid extent pointer with a
   corrupt disk offset
2. It calls __bch2_bkey_fsck_err() to report the error
3. The fsck logic decides to delete the corrupt key
4. Meanwhile, __bch2_bkey_fsck_err() calls bch2_bkey_val_to_text()
5. This traverses the extent entries via bch2_extent_ptr_to_text()
6. sector_to_bucket_and_offset() is called with the corrupt offset
7. Memory access occurs on data being concurrently freed

The crash happens in bch2_extent_ptr_to_text() when it attempts to
validate bucket boundaries using already-freed extent pointer data.

Replace bch2_bkey_val_to_text() with bch2_bpos_to_text() to print
only the key position (inode, offset, snapshot) instead of traversing
potentially corrupt or freed extent metadata. The position is part of
the key header and remains safe to read even as the extent data is
being freed. The specific validation error is still printed in the
subsequent lines, providing sufficient context for debugging.

Tested successfully locally using syzbot provided reproducer

Reported-by: syzbot+564efbe31172fe908429@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?id=564efbe31172fe908429
Fixes: d97de0d017cd ("bcachefs: Make bkey_fsck_err() a wrapper around fsck_err()")
Signed-off-by: Shaurya Rane <ssrane_b23@ee.vjti.ac.in>
---
 fs/bcachefs/error.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/bcachefs/error.c b/fs/bcachefs/error.c
index 267e73d9d7e6..b0bf08915aa2 100644
--- a/fs/bcachefs/error.c
+++ b/fs/bcachefs/error.c
@@ -688,7 +688,7 @@ int __bch2_bkey_fsck_err(struct bch_fs *c,
 	bch2_btree_id_to_text(&buf, from.btree);
 	prt_printf(&buf, " level=%u: ", from.level);
 
-	bch2_bkey_val_to_text(&buf, c, k);
+	bch2_bpos_to_text(&buf, k.k->p);
 	prt_newline(&buf);
 
 	va_list args;
-- 
2.34.1

Re: [syzbot] [bcachefs?] kernel BUG in bch2_btree_path_level_init (4)

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+55c84106264e92ea9ada@syzkaller.appspotmail.com
Tested-by: syzbot+55c84106264e92ea9ada@syzkaller.appspotmail.com

Tested on:

commit:         6093a688 Merge tag 'char-misc-6.18-rc1' of git://git.k..
git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=16ea2458580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=e2b03b8b7809165e
dashboard link: https://syzkaller.appspot.com/bug?extid=55c84106264e92ea9ada
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

Note: no patches were applied.
Note: testing is done by a robot and is best-effort only.

Re: [PATCH] bcachefs:fix use-after-free in __bch2_bkey_fsck_err

[Kent Overstreet]

On Sun, Oct 05, 2025 at 09:38:25PM +0530, SHAURYA RANE wrote:
> #syz test:
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

Instead of having syzbot test your code, please try the ktest syzbot
reproducer test:

https://evilpiepirate.org/git/ktest.git/

build-test-kernel run -I ~/ktest/tests/syzbot-repro.ktest <bug-id>

I get very nervous when people send me patches they've never run
themselves. Always try to have eyes on what your code is doing, try to
look with your eyes and see that it's doing what you think it's doing :)

Re: [PATCH] bcachefs:fix use-after-free in __bch2_bkey_fsck_err

[SHAURYA RANE]

Thanks for the feedback. I’ve tested the patch locally as well using
kselftest, and it passed successfully.



On Mon, Oct 6, 2025 at 3:16 PM SHAURYA RANE <ssrane_b23@ee.vjti.ac.in> wrote:
>
> Thanks for the feedback. I’ve tested the patch locally as well using kselftest, and it passed successfully.
>
> Best regards,
> Shaurya Rane
>
> On Sun, 5 Oct 2025, 23:35 Kent Overstreet, <kent.overstreet@linux.dev> wrote:
>>
>> On Sun, Oct 05, 2025 at 09:38:25PM +0530, SHAURYA RANE wrote:
>> > #syz test:
>> > https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
>>
>> Instead of having syzbot test your code, please try the ktest syzbot
>> reproducer test:
>>
>> https://evilpiepirate.org/git/ktest.git/
>>
>> build-test-kernel run -I ~/ktest/tests/syzbot-repro.ktest <bug-id>
>>
>> I get very nervous when people send me patches they've never run
>> themselves. Always try to have eyes on what your code is doing, try to
>> look with your eyes and see that it's doing what you think it's doing :)

Re: [syzbot] [bcachefs?] kernel BUG in bch2_btree_path_level_init (4)

[syzbot]

syzbot suspects this issue was fixed by commit:

commit f2c61db29f277b9c80de92102fc532cc247495cd
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Mon Sep 29 20:43:52 2025 +0000

    Remove bcachefs core code

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=100837cd980000
start commit:   d69eb204c255 Merge tag 'net-6.17-rc5' of git://git.kernel...
git tree:       upstream
kernel config:  https://syzkaller.appspot.com/x/.config?x=bd9738e00c1bbfb4
dashboard link: https://syzkaller.appspot.com/bug?extid=55c84106264e92ea9ada
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1788c962580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=12b0887c580000

If the result looks correct, please mark the issue as fixed by replying with:

#syz fix: Remove bcachefs core code

For information about bisection process see: https://goo.gl/tpsmEJ#bisection